Free tool
Marketing Agency Compliance Checker
Nine questions on the gaps that move a client's compliance problem onto your agency — DPAs, your processor role, consent evidence, claim sign-off. Instant verdict, no signup.
Agency compliance check
Answer for how your agency works today, not how the handbook says it should
0 of 9 answered · runs in your browser, nothing is sent or stored
1.Do you have a signed data processing agreement with every client whose data you touch?
2.For each service you sell, can you say clearly whether you act as processor or as joint controller?
3.Before you upload a client's customer list to an ad platform, do you verify the consent or lawful basis behind it?
4.Does every substantive claim in client copy have a named source and a sign-off before it goes live?
5.Have your clients approved every sub-processor you use, including freelancers and reporting tools?
6.Do you know which of your tools move EU personal data outside the EEA, and on what transfer mechanism?
7.Are you checking client environmental claims against the EU rules that apply from 27 September 2026?
8.When a client leaves, do you delete or return their personal data on a defined timetable?
9.If a client is audited, could you produce your compliance record for their campaigns in a week?
Answer every question to get your verdict.
Why this matters for agencies
The agency is the visible actor
Agencies rarely own the data and rarely own the brand, but they write the claim, build the audience, and press publish. When a campaign is challenged, those are the three acts that get examined — and the agency is the party that performed them.
Most agency exposure is documentary rather than technical: no DPA, no record of which list was uploaded on what basis, no evidence of who approved a claim. The fix is a process, and the process is cheap compared to unwinding a live campaign.
The copy-level part is where a tool helps. Running client ads and landing pages through the free GDPR ad copy checker before launch gives you a dated record per asset. For the platform-specific setup, use the GDPR checker for Facebook ads and the Google Ads policy checker, and see retargeting ads and GDPR compliance for the audience-building rules.
FAQ
Agency compliance — questions
Is a marketing agency a controller or a processor under GDPR?
It depends on the service. Running campaigns on a client's instructions with the client's data is processing. Deciding targeting parameters, building audiences from your own data, or reusing client data for your own purposes makes you a controller or joint controller for that activity, with direct liability rather than contractual liability.
Does an agency need its own DPA with each client?
Yes. Article 28(3) requires a written contract between controller and processor, and it must cover the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the controller's rights. A general services agreement with a privacy clause is not sufficient.
Who is liable if a client's ad campaign breaches the rules?
Both parties can be. The client is usually the controller and carries the primary GDPR liability, but a processor is directly liable where it acts outside instructions or fails its own Article 28 duties. For misleading advertising claims, enforcement follows the trader — with the agency exposed where it authored and published the claim.
What compliance tools does a marketing agency actually need?
In practice: a consent management platform per client site, a documented DPA and sub-processor process, a claims substantiation log, and a copy-level scanner that checks ad and landing-page wording before it goes live. The first three are process; the last is where a tool saves real review time.
Can Legalify be used across multiple client accounts?
Yes. Scans are run per piece of copy and saved to your account's history and Document Vault, so an agency can keep a per-client record of what was checked and when. Only a SHA-256 hash of the scanned text is stored, not the text itself.
Put a dated check on every client asset
Scan client ads and landing pages before launch, and keep the report. A free account adds saved history and the Document Vault across all your clients.